Add memory obfuscation and ps-hidden process detection

CLAUDE.md

@@ -54,9 +54,10 @@ Start with:
 - `respond.py` builds read-only response plans from incident evidence.
 - `web.py` serves the HTTPS-only management console and JSON APIs.
 - `rootcheck.py` performs anti-rootkit cross-view checks:
-  hidden processes, hidden modules, hidden TCP/UDP/raw/special-protocol sockets,
-  raw ICMP/SCTP-style channels, promiscuous interfaces, known LKM rootkit module
-  names, and kernel/module taint.
+  hidden processes, processes hidden from `ps`, hidden modules, hidden
+  TCP/UDP/raw/special-protocol sockets, raw ICMP/SCTP-style channels,
+  promiscuous interfaces, known LKM rootkit module names, and kernel/module
+  taint.
 - `posture.py` performs advisory host hygiene checks.
 
 ## Current Threat Mapping
@@ -66,11 +67,13 @@ Recent local sample families used for defensive coverage:
 - Gonzalo-style implant/rootkit behavior: direct input-event keylogging,
   credential harvesting, LD_PRELOAD/tool tampering, persistence writes, raw ICMP
   and SCTP-style knock/listener paths, deleted/fileless execution, and hidden
-  sockets/modules.
+  sockets/modules, plus heap/string obfuscation and mapped process-hiding
+  libraries.
 - Peopleswar-style C2 behavior: TLS C2 listener/check-in traffic, command queue
   responses, and API/listener ports. Sentinel should prefer behavior coverage
-  (`new_listener`, `egress`, `stealth_network`, rootcheck, credential/input
-  detectors) over brittle sample-name matching unless adding explicit IOCs.
+  (`new_listener`, `egress`, `stealth_network`, `memory_obfuscation`, rootcheck,
+  credential/input detectors) over brittle sample-name matching unless adding
+  explicit IOCs.
 
 ## Development Commands